1

I feel each step i take this one 5 more walls come up its fun but also frustrating.

So I'm trying to login to a website through cURL and after a lot of head scratching and the use of firefox developer tools I saw that my browser was responding in JSON. I honestly dont know anything about JSON but i feel like if i get through this I'll be in the clear.

So the question is how do i emulate these JSON responses with cURL? do i just copy and paste what they are in an array? Do i include this array in each http requests or do i do them all seperately.

Here is the JSON code if you guys want to see it.

__jsonp1__([{"id":"1","channel":"/meta/handshake","successful":true,"version":"1.0","supportedConnectionTypes":["long-polling","cross-origin-long-polling","callback-polling","websocket","eventsource","in-process"],"clientId":"adag3o01k7uyb0ub4s2v1h4r7fs1m3zfvp0","advice":{"reconnect":"retry","interval":0,"timeout":600000}}]);

__jsonp2__([{"id":"3","clientId":"adag3o01k7uyb0ub4s2v1h4r7fs1m3zfvp0","channel":"/meta/connect","successful":true,"advice":{"reconnect":"retry","interval":0,"timeout":600000}},{"id":"2","clientId":"adag3o01k7uyb0ub4s2v1h4r7fs1m3zfvp0","channel":"/meta/subscribe","successful":true,"subscription":"/user/11585628"}]);

__jsonp3__([{"id":"4","clientId":"adag3o01k7uyb0ub4s2v1h4r7fs1m3zfvp0","channel":"/meta/connect","successful":true,"advice":{"reconnect":"retry","interval":0,"timeout":600000}},{"channel":"/user/11585628","data":{"type":"subscribe"},"clientId":"adag3o01k7uyb0ub4s2v1h4r7fs1m3zfvp0","id":"5","authenticated":true}]);

_jsonp4__([{"id":"1","channel":"/meta/handshake","successful":true,"version":"1.0","supportedConnectionTypes":["long-polling","cross-origin-long-polling","callback-polling","websocket","eventsource","in-process"],"clientId":"uiqqkp0vf66rl0mlc8281ufknaw1qkcriu1","advice":{"reconnect":"retry","interval":0,"timeout":600000}}]);

here is my code I was trying somethings so thats why it make look a little weird

<?php


$ckfile ='   __utma=173730677.1410450142.1370766442.1370882903.1370893342.8; __utmz=173730677.1370893342.8.6.utmcsr=web.groupme.com|utmccn=(referral)|utmcmd=referral|utmcct=/groups; __utma=64278953.892306882..1370882931.1370893339.9; __utmz=64278953.1370882931.8.4.utmcsr=groupme.com|utmccn=(referral)|utmcmd=referral|utmcct=/signin; _g=%3D%3D--772097f0c6a077ac0f904c981ba5523ddffef3d5; __utmc=64278953; __utmc=173730677; __utmb=64278953.1.10.1370893339; __utmb=173730677.2.10.1370893342';

$postfields = '{"username":"@gmail.com","password":"somepass","app_id":"groupme.com","grant_type":"password"}';
$postfields2 ='{"group":{"name":"test","memberships":[]}}';
$custom = 'X-Access-Token: CEbhaIkkKTc9dtVMpxyc2IZOfnzEoh5w4UTzsVSb';

$ch2 = curl_init();
$ch3 = curl_init();

$ch = curl_init();





curl_setopt_array(
    $ch,
    array(
    CURLOPT_SSL_VERIFYPEER => false,
    CURLOPT_URL => 'https://web.groupme.com/#access_token=some token',
    CURLOPT_COOKIE=> $ckfile,
    CURLOPT_USERAGENT =>'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20100101 Firefox/21.0',
    CURLOPT_REFERER => 'https://groupme.com/signin',
    CURLOPT_RETURNTRANSFER => true, 
    //CURLOPT_FOLLOWLOCATION => true,
    CURLOPT_HTTPHEADER => array('Host: web.groupme.com','Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8','Accept-Language: en-US,en;q=0.5','Accept-Encoding: gzip, deflate')
    )
);


curl_setopt_array(
    $ch2,
    array(
    CURLOPT_SSL_VERIFYPEER => false,
    CURLOPT_URL => 'https://web.groupme.com/#access_token=some token',
    CURLOPT_COOKIE=> $ckfile,
    CURLOPT_USERAGENT =>'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20100101 Firefox/21.0',
    CURLOPT_REFERER => 'https://groupme.com/signin',
    CURLOPT_RETURNTRANSFER => true, 
    //CURLOPT_FOLLOWLOCATION => true,
    CURLOPT_HTTPHEADER => array('Host: web.groupme.com','Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8','Accept-Language: en-US,en;q=0.5','Accept-Encoding: gzip, deflate','Content-Type=text/html;charset=utf-8','Server=thin 1.3.1 codename Triple Espresso','Strict-Transport-Security=max-age=31536000','X-Frame-Options=sameorigin','x-xss-protection=1; mode=block','Content-Length=24275')
    )
);



$response = curl_exec($ch2);
//curl_close($ch);  



echo '<pre>';
print_r($response);
echo '</pre>'
?>
user2471201
  • 41
  • 1
  • 4
  • Depends what you're trying to do. Have you been able to successfully login? – silkfire Jun 11 '13 at 07:24
  • @silkfire no I haven't, when i try to i get the same result as when i attempt to login without javascript enabled in my browser. What I'm trying to do is Login input some simple data grab some simple data then go. – user2471201 Jun 11 '13 at 07:26
  • with json_encode you could make json out of an array – Petros Mastrantonas Jun 11 '13 at 07:27
  • I think you have some sensitive information in there. – vascowhite Jun 11 '13 at 07:27
  • JSONP is usually sent _from_ websites, not _to_ websites. – Barmar Jun 11 '13 at 07:31
  • @PetrosMastrantonas so I would say what i want to say in php then it would convert it to JSON. – user2471201 Jun 11 '13 at 07:31
  • @vascowhite its fine its a throw away email and account so no real information important to me. but i dont see anything sensitive? – user2471201 Jun 11 '13 at 07:31
  • Post us the code, please. – silkfire Jun 11 '13 at 07:32
  • @Barmar so you're saying this infor is being sent to my browser meaning cURL needs to interpret it? – user2471201 Jun 11 '13 at 07:33
  • I don't know, you tell me. You should be able to tell from developer tools whether it's being sent or received by the browser. If received, then yes, you need to interpret it. Just strip off `_jsonp#__(` and `)`, then use `json_decode` to parse the rest. – Barmar Jun 11 '13 at 07:35
  • @Barmar from the looks of it seems like the browser is receiving info because it has things like avatar url, my email, and number. – user2471201 Jun 11 '13 at 07:41
  • Have a look at [Extract JSONP Resultset in PHP](http://stackoverflow.com/q/5081557/218196). The data format you receive is commonly called *JSONP*. Have a look at the Wikipedia article: http://en.wikipedia.org/wiki/JSONP. – Felix Kling Jun 11 '13 at 08:01
  • @FelixKling thank you! Why would a website use JSONP? – user2471201 Jun 11 '13 at 08:11
  • @user2471201: There are only two ways for client side JavaScript to dynamically load data from a third-party website: CORS (http://en.wikipedia.org/wiki/Cross-origin_resource_sharing) and JSONP. I think JSONP existed before CORS. It's a very simple technique but sufficient in most cases. – Felix Kling Jun 11 '13 at 08:14
  • @FelixKling Wait why would they need a third party website in the first place? I just want to login into their website no one elses. – user2471201 Jun 11 '13 at 08:19
  • No, `https://web.groupme.com/` is the third-party site. Imagine you are not logging in with PHP on a server but with JavaScript in the browser. Then you need the response as JSONP because you could not get it otherwise. – Felix Kling Jun 11 '13 at 08:21
  • @FelixKling Ok i think Im starting to get things now, thank you for your explanation. only thing now is to figure out if I should be sending the data and encoding it JSON or decoding the JSON so php nows how to interpret it. Ahhh! Im so close but so lost but again thank you. – user2471201 Jun 11 '13 at 08:34
  • It looks like that the only thing you have to send is the access token in URL and that's just one value. If the documentation doesn't say it should be sent JSON encoded, then you are fine. You receive the response encoded as JSONP. After you remove the `__jsonp3__(` and `);` parts, you will be left with a string containing JSON (JSON is just a data format, like XML, CSV, YAML, etc). Then you use `json_decode` to parse the JSON and convert it to native PHP arrays and objects. That's it :) – Felix Kling Jun 11 '13 at 08:38
  • @FelixKling wow man how were you able to figure out all i need is the access token? but at this point you've been of too much help thank you, I wish I could up vote or something like that. wait a sec your ranked topped 50! – user2471201 Jun 11 '13 at 08:42
  • Actually I only assumed you only needed the access token. There might be other parameters you have to send with the URL. But since JSONP only works with GET requests, I doubt you will have to make a POST request and send other parameters. In any way, the documentation of the service should tell you for sure what you have to send ;) – Felix Kling Jun 11 '13 at 09:20
  • well you were right you only need the token. – user2471201 Jun 11 '13 at 09:27

0 Answers0